Skip to main content

libexpat EUVDEUVD-2026-63493

| CVE-2026-76641 HIGH
Out-of-bounds Read (CWE-125)
2026-08-20 VulnCheck GHSA-r6r4-8m79-7vvv
Information Disclosure Buffer Overflow Libexpat Suse
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-delivered crafted XML requires no authentication (PR:N); scope unchanged; impact is availability loss via segfault with no confirmed confidentiality or integrity breach.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 20, 2026 - 18:21 vuln.today
Analysis Generated
Aug 20, 2026 - 18:21 vuln.today
CVE Published
Aug 20, 2026 - 17:31 cve.org
HIGH 8.7

DescriptionCVE.org

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

AnalysisAI

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parses attacker-controlled XML with external entity resolution enabled. The flaw - introduced as a regression by the CVE-2026-66046 fix - causes dtdCopy() to allocate hash entries with the smaller sizeof(NAMED) instead of sizeof(NAME_AND_DEFAULT_ATTRIBUTE), so storeAtts() subsequently reads the attIndex member past the end of the allocated block when handling external entity parsers created via XML_ExternalEntityParserCreate. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft XML document with external entity declaration
Delivery
Deliver payload to application parsing untrusted XML
Exploit
Application calls XML_ExternalEntityParserCreate triggering dtdCopy
Execution
dtdCopy allocates undersized NAME_AND_DEFAULT_ATTRIBUTE entries
Persist
storeAtts reads attIndex past allocated buffer boundary
Impact
Wild pointer dereference causes segfault and process crash
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: (1) the target application links libexpat in an affected version (≤2.8.3 incorporating the CVE-2026-66046 fix); (2) the application accepts attacker-supplied XML input without sanitizing or rejecting external entity references; and (3) external entity resolution is active - the application must call XML_ExternalEntityParserCreate() in response to an external entity declaration in the DTD. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects a network-reachable, unauthenticated, low-complexity path to a high-availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits a crafted XML document containing an external entity declaration pointing to an attacker-controlled or arbitrary URI to a web service, document processor, or API endpoint that uses libexpat for parsing. The application calls XML_ExternalEntityParserCreate() to resolve the entity, triggering dtdCopy() to copy the DTD with undersized hash-table entries; storeAtts() subsequently reads the attIndex field beyond the allocated buffer boundary, causing a wild pointer dereference and segfault that crashes the hosting process. …
Remediation The primary fix is to update libexpat to a version incorporating upstream commit 98599f6dcc2b460410881fe420f5f55d6bec63bf (PR #1331: https://github.com/libexpat/libexpat/pull/1331); a tagged release version has not been confirmed from available data, so monitor the libexpat GitHub releases page and applicable Linux distribution security channels (Debian DSA, Ubuntu USN, RHEL RHSA) for a versioned package. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory applications and systems running libexpat through version 2.8.3 to identify exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2016-4472 HIGH
8.1 Jun 30

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke
CVE-2022-40674 HIGH
8.1 Sep 14

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. Rated high severity (CVSS 8.1), this

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

EUVD-2026-63493 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy